Exploiting Safety

• Requirement 4: Only reversible transitions are allowed, except when repairing a component.

Rationale: Irreversible actions expend non-renewable resources. Require careful (human?) deliberation.

Valve Driver

Turn on

Turn

off

Turn off

On

Off

Resettable

failure

Permanent

failure

Closed

Pyro Valve

Open

Stuck

open

Stuck

closed

Open

disallowed

allowed

Reset

Previous slide

Next slide

Back to first slide

View graphic version